Eggstravaganza
First Flight #37
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Active Game Parameter Manipulation

edoscoba

Summary

The setEggFindThreshold function allows the contract owner to modify the egg finding probability during an active game session, severely compromising game fairness, integrity.

Vulnerability Details

The EggHuntGame contract permits the modification of the egg finding probability threshold at any time, including during active game sessions:

function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
require(newThreshold <= 100, "Threshold must be <= 100");
eggFindThreshold = newThreshold;
}

The function lacks a crucial check to prevent modifications while gameActive is true. This allows the contract owner to arbitrarily adjust the game's core mechanics after players have already begun participating, violating the principle of consistent game rules.

The eggFindThreshold directly impacts the probability of finding eggs in the searchForEgg function:

if (random < eggFindThreshold) {
// Egg found logic
}

Proof of Concept

  1. Owner starts a game with startGame(duration)

  2. Players begin participating with searchForEgg() at the advertised 20% probability

  3. Owner calls setEggFindThreshold(1) to drastically reduce winning chances

  4. Most players fail to find eggs due to the secretly reduced 1% probability

  5. Owner calls setEggFindThreshold(90) when a specific address is about to participate

  6. Favored address enjoys a 90% chance of finding eggs

Impact

  • Uneven Gameplay: Players participating at different times face inconsistent odds, breaching fair play principles.

  • Trust Violation: Players cannot rely on the game maintaining consistent mechanics throughout a session.

Tools Used

Manual Review

Recommendations

Restrict parameter modifications during active gameplay by adding a state check:

function setEggFindThreshold(uint256 newThreshold) external onlyOwner {
require(!gameActive, "Cannot modify parameters during active game");
require(newThreshold > 0, "Threshold must be > 0");
require(newThreshold <= 100, "Threshold must be <= 100");
eggFindThreshold = newThreshold;
}
Updates

Lead Judging Commences

m3dython Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.